Do we need to repeat this in every test case? Maybe we could factor it out to keep the test cases simpler?

Seems okay to me, although I think it would also be fine to just let the server handle this instead and not bother checking it on the CLI side (as long as we print a useful error in the CLI when the server rejects our request -- maybe there is a separate patch needed for that?)

The CLI should be also changed to accommodate recent changes for the replace 'subject' with 'subject_type' and 'subject_identifier'.

So perhaps replace --subject option (make obsolete) with two new options. Using JSON in CLI is definitely not user-friendly.

maybe we can drop this one?

I'm OK with dropping this and replacing the JSON option on CLI.